> ## Documentation Index
> Fetch the complete documentation index at: https://developers.thinkout.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys are bound to one workspace and sent as a bearer token.

Every request carries an API key in the `Authorization` header:

```bash theme={"system"}
curl https://api.thinkout.io/v1/accounts \
  -H "Authorization: Bearer $THINKOUT_API_KEY"
```

## Keys and workspaces

A key belongs to exactly one workspace. There is no workspace parameter in the URL: the key decides which workspace you read. To read several workspaces, create one key per workspace.

Keys are created by workspace owners and managers in ThinkOut under **Settings**. The full key is shown once at creation. Store it in a secrets manager and never in client-side code or a public repository.

## Permissions

A key can list and fetch every resource of its workspace and nothing else. Version 1 exposes only reads, and there is no scope selection.

## Rotation and revocation

Revoke a key from the same settings page. Revocation is immediate: the next request with that key returns `401`. Create the replacement key first, deploy it, then revoke the old one.

## Failure responses

| Status | `error.code`   | Meaning                                                             |
| ------ | -------------- | ------------------------------------------------------------------- |
| `401`  | `unauthorized` | The header is missing, malformed, or the key is unknown or revoked. |
| `403`  | `forbidden`    | The key is valid but the workspace is inactive.                     |

See [Errors](/guides/errors) for the envelope.